Vulnerability record · CVE-2013-4674 · published 31 July 2013

CVE-2013-4674: Symantec encryption management server cross-site scripting vulnerability

Symantec · Encryption Management Server

Cross-site scripting (XSS) vulnerability in the Web Email Protection component in Symantec Encryption Management Server (formerly Symantec PGP Universal Server) before 3.3.0 MP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted encrypted e-mail attachment.

4.3 CVSS 2.0 Medium EPSS 0.89% · top 42.3% CWE-79 · Cross-site scripting

4.3CVSS 2.0 base score

0.89%EPSS exploitation probability, 30 days

NoNot in CISA KEV

2Affected product versions listed by NVD

12References

16 Jun 2026Last modified by NVD

Description

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Encryption Management Server Symantec

Pgp Universal Server Symantec

References

Link	Tags
http://osvdb.org/95581
http://secunia.com/advisories/54214
http://www.securityfocus.com/bid/61290
http://www.securitytracker.com/id/1028820
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/85902
http://osvdb.org/95581
http://secunia.com/advisories/54214
http://www.securityfocus.com/bid/61290
http://www.securitytracker.com/id/1028820
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/85902

Track CVE-2013-4674 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2015-8151Symantec encryption management server os command injection vulnerabilitySymantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote authenticated users to execute arbitrary OS commands by leveraging conso…EPSS 1.6%18 Feb 2016 9.0CVE-2014-7288Symantec encryption management server permissions and access controls vulnerabilitySymantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allow remote authenticated administrators to execute arbitrary shell …EPSS 8.1%1 Feb 2015 7.8CVE-2015-8150Symantec encryption management server permissions and access controls vulnerabilitySymantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows local users to obtain root access by modifying a batch file.EPSS 0.28%18 Feb 2016 7.5CVE-2018-5243Symantec encryption management server uncontrolled resource consumption vulnerabilityThe Symantec Encryption Management Server (SEMS) product, prior to version 3.4.2 MP1, may be susceptible to a denial of service (DoS) exploit. A DoS …EPSS 1.8%20 Aug 2018 7.5CVE-2015-8148Symantec encryption management server information exposure vulnerabilityThe LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to obtain sensitive information about admi…EPSS 1.6%18 Feb 2016 7.5CVE-2015-8149Symantec encryption management server memory buffer overflow vulnerabilityThe LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to cause a denial of service (heap memory …EPSS 1.7%18 Feb 2016 5.0CVE-2014-7287Symantec encryption management server injection vulnerabilityThe key-management component in Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allows remote attackers to trigger un…EPSS 1.1%1 Feb 2015 4.0CVE-2014-1643Symantec encryption management server permissions and access controls vulnerabilityThe Web Email Protection component in Symantec Encryption Management Server (aka PGP Universal Server) before 3.3.2 allows remote authenticated users…EPSS 0.75%7 Feb 2014

Source: NIST National Vulnerability Database (record CVE-2013-4674), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.